IETF Logo Mail Archive

Re: [OAUTH-WG] Identifying OAuth 2.0 vs 1.0 requests

Eran Hammer-Lahav <eran@hueniverse.com> Thu, 10 June 2010 15:44 UTC

Return-Path: <eran@hueniverse.com>
X-Original-To: oauth@core3.amsl.com
Delivered-To: oauth@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D2D7528C0E9 for <oauth@core3.amsl.com>; Thu, 10 Jun 2010 08:44:27 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -0.802
X-Spam-Level:
X-Spam-Status: No, score=-0.802 tagged_above=-999 required=5 tests=[AWL=-0.063, BAYES_20=-0.74, HTML_MESSAGE=0.001]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YEG4l8-JGZmA for <oauth@core3.amsl.com>; Thu, 10 Jun 2010 08:44:26 -0700 (PDT)
Received: from p3plex1out01.prod.phx3.secureserver.net (p3plex1out01.prod.phx3.secureserver.net [72.167.180.17]) by core3.amsl.com (Postfix) with SMTP id B5B253A695F for <oauth@ietf.org>; Thu, 10 Jun 2010 08:44:26 -0700 (PDT)
Received: (qmail 8280 invoked from network); 10 Jun 2010 15:44:24 -0000
Received: from unknown (HELO smtp.ex1.secureserver.net) (72.167.180.21) by p3plex1out01.prod.phx3.secureserver.net with SMTP; 10 Jun 2010 15:44:24 -0000
Received: from P3PW5EX1MB01.EX1.SECURESERVER.NET ([10.6.135.20]) by P3PW5EX1HT003.EX1.SECURESERVER.NET ([72.167.180.21]) with mapi; Thu, 10 Jun 2010 08:44:23 -0700
From: Eran Hammer-Lahav <eran@hueniverse.com>
To: Paul Lindner <lindner@inuus.com>, "OAuth WG (oauth@ietf.org)" <oauth@ietf.org>
Date: Thu, 10 Jun 2010 08:44:17 -0700
Thread-Topic: [OAUTH-WG] Identifying OAuth 2.0 vs 1.0 requests
Thread-Index: AcsIsPkBzOQ+FzigT2SxkTBZei3iNgAAr1SA
Message-ID: <90C41DD21FB7C64BB94121FBBC2E72343B3EAF729E@P3PW5EX1MB01.EX1.SECURESERVER.NET>
References: <AANLkTilcANtf9WsFh4jJPUBkbCu5x2doTMQEr4_h_Rys@mail.gmail.com>
In-Reply-To: <AANLkTilcANtf9WsFh4jJPUBkbCu5x2doTMQEr4_h_Rys@mail.gmail.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
acceptlanguage: en-US
Content-Type: multipart/alternative; boundary="_000_90C41DD21FB7C64BB94121FBBC2E72343B3EAF729EP3PW5EX1MB01E_"
MIME-Version: 1.0
Subject: Re: [OAUTH-WG] Identifying OAuth 2.0 vs 1.0 requests
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/oauth>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 10 Jun 2010 15:44:27 -0000

The request is very different on the resource server. On the authorization server, why would you use the same endpoint?

EHL

From: oauth-bounces@ietf.org [mailto:oauth-bounces@ietf.org] On Behalf Of Paul Lindner
Sent: Thursday, June 10, 2010 8:24 AM
To: OAuth WG (oauth@ietf.org)
Subject: [OAUTH-WG] Identifying OAuth 2.0 vs 1.0 requests

Hi,

As I've been working through our oauth2 implementation I've noticed that it's not easy to disambiguate OAuth 1.0a vs 2.0 API calls based on the request parameters alone.   Based on some investigative at the Shindig project it appears that the only standard way to to determine 1.0a vs 2.0 is by checking for the oauth_signature_method parameter.  More info here:

https://issues.apache.org/jira/browse/SHINDIG-1361

Has anyone else considered this use case?  How did you solve it?

v2.46.0 | Report a Bug | By Email | System Status